Path traversal in profile snippets import allows writing files outside the profile directory (Zip-Slip)

VS Code - Security Feature Bypass Vulnerability

An elevation of privilege vulnerability exists in VS Code 1.123.0 and earlier versions where a user who is tricked into importing a crafted .code-profile file containing a snippet entry with a maliciously crafted name could have attacker-controlled content written to an arbitrary file location outside the intended profile snippets directory. The snippet name is used to construct the destination file path without sufficient validation, allowing path traversal sequences (for example, ../) to escape the snippets folder and write to any location writable by the user, which could lead to code execution or configuration tampering.

Patches

The fix is available starting with VS Code 1.123.1. The fix (9b31ff896671125cbfc65f33731c4a99660d6201) mitigates this by skipping creating the files outside snippets directory

Workarounds

Do not create profiles from untrusted sources

References

• The patch for this can be found at 9b31ff896671125cbfc65f33731c4a99660d6201
• An issue for this can be found at https://github.com/microsoft/vscode/issues/320679
• MSRC details for this can be found at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47287